fix: bump urllib3 and pydantic to resolve 7 CVEs, drop Python 3.9, add Python 3.14

[redhat-chai-bot]

Summary

Bumps minimum version constraints for urllib3 and pydantic to address all security vulnerabilities identified by Dependabot. Also drops Python 3.9 support (EOL Oct 2025) to enable full urllib3 CVE coverage, and adds Python 3.14 to the CI matrix.

Changes

Dependency bumps

• urllib3: >= 2.1.0 → >= 2.7.0 (fixes all 6 urllib3 CVEs)
• pydantic: >= 2 → >= 2.4.0 (fixes 1 CVE)

Applied consistently across requirements.txt, setup.py, and pyproject.toml.

Python version

• requires-python: >= 3.9 → >= 3.10 (in setup.py and pyproject.toml)
• CI matrix: removed Python 3.9, added Python 3.14 (.github/workflows/python.yml)

Rationale for dropping Python 3.9

• Python 3.9 reached end-of-life in October 2025
• AAP 2.6 ships ansible-core 2.16, which requires Python 3.10+ for the controller
• Red Hat certification requires ansible-core 2.16 minimum and Python 3.12 testing
• The flightctl.edge Ansible collection already requires Python 3.12+
• urllib3 2.7.0 dropped Python 3.9 support — keeping 3.9 would leave 2 High-severity CVEs unfixed

Rationale for adding Python 3.14

• Python 3.14 has been stable since October 2025 (currently at 3.14.7)
• urllib3 2.7.0 explicitly added Python 3.14 support including free-threading builds

CVEs Addressed (all 7 fixed)

CVE	Package	Severity	Fixed In
CVE-2025-66471	urllib3	High (CVSS 4.0: 8.9)	2.6.0
CVE-2025-66418	urllib3	High (CVSS 4.0: 8.9)	2.6.0
CVE-2025-50182	urllib3	Medium (CVSS 3.1: 5.3)	2.5.0
CVE-2026-21441	urllib3	High (CVSS 3.1: 7.5)	2.6.3
CVE-2026-44431	urllib3	High (CVSS 4.0: 8.2)	2.7.0
CVE-2026-44432	urllib3	High (CVSS 4.0: 8.9)	2.7.0
CVE-2024-3772	pydantic	Medium (CVSS 3.1: 5.9)	2.4.0

Validation

• Pre-fix scan: pip-audit confirmed vulnerabilities present
• Post-fix scan: pip-audit reports no known vulnerabilities
• Tests: 427 passed (0 failures)

[asafbennatan]

LGTM